The use of several methods of reading files in MySQL

MySQL database in the penetration process can use more features, in addition to reading data , you can also read and write to the file (but only if the permissions are sufficient)

Summarized under MySQL read file method in different versions roughly there are these 3:

1.load_file () 2.load Data infile ()

3.system Cat

Load_file () and load data infile read the file by creating a new table, reading the file as a string into the table, and then reading the data from the table.

However, there are usually two prerequisites:

1. Under the premise of having file permission

2.secure_file_priv is not NULL

The value of Secure_file_priv can be viewed in this way

After MySQL 5.6.34 version, the value of SECURE_FILE_PRIV is defaulted to null. Can be modified in the following ways

Under Windows :

Modify the Mysql.ini file and add an entry under [mysqld]: Secure_file_priv =

Save and restart MySQL.

Under Linux :

Add the local-infile=0 option under/ETC/MY.CNF [Mysqld].

1.load_file ()

First I create a document in the/tmp directory

Running MySQL

The SQL command is as follows:

1 Create Table text ); 2 Insert  into User (cmd) Values (Load_file ('/tmp/1.txt')); 3 Select *  from user;

　

2.load Data infile

In fact, there is no difference between the load data infile and Load_file () usage, but in the injection process, the load_file () function is often filtered out, but the load data infile is still available.

1 Load ' /tmp/1.txt '  into Table user;

3.system Cat

When the MySQL version is 5.x, you can use the system commands to read the file directly in addition to the last two methods

Attention:

1. This method can only be read locally, the system cannot be used when connecting to MySQL remotely.

2. Unable to read beyond the bounds.

The use of several methods of reading files in MySQL